Scope 3 assurance: what auditors look for